libgit2: use provided host to validate public key

The callback from libgit2 only provides a hostname (without the port), but the `known_hosts` file indexes the public keys based on the full host (e.g. `[localhost]:123` for a host behind a specific port). As a result, it was unable to find the correct public key for the hostname when it was added to the `known_hosts` file with the port. To work around this, we add the user provided host that includes the port to the `PublicKeyAuth` strategy, and use this to find the right entry in the `known_hosts` file, after having validated that the hostname provided to the callback matches the hostname of the host provided by the user. Signed-off-by: Hidde Beydals <[email protected]>
fluxcd · Feb 10, 2021 · 31efe5c · 31efe5c
1 parent b501172
commit 31efe5c
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 10 deletions.
diff --git a/pkg/git/libgit2/transport.go b/pkg/git/libgit2/transport.go
@@ -22,10 +22,12 @@ import (
 	"crypto/sha1"
 	"crypto/x509"
 	"fmt"
+	"net"
 	"net/url"
 	"strings"
 
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
 
 	git2go "github.com/libgit2/git2go/v31"
 	corev1 "k8s.io/api/core/v1"
@@ -43,7 +45,7 @@ func AuthSecretStrategyForURL(URL string) (git.AuthSecretStrategy, error) {
 	case u.Scheme == "http", u.Scheme == "https":
 		return &BasicAuth{}, nil
 	case u.Scheme == "ssh":
-		return &PublicKeyAuth{user: u.User.Username()}, nil
+		return &PublicKeyAuth{user: u.User.Username(), host: u.Host}, nil
 	default:
 		return nil, fmt.Errorf("no auth secret strategy for scheme %s", u.Scheme)
 	}
@@ -62,7 +64,7 @@ func (s *BasicAuth) Method(secret corev1.Secret) (*git.Auth, error) {
 		password = string(d)
 	}
 	if username != "" && password != "" {
-		credCallback = func(url string, username_from_url string, allowed_types git2go.CredType) (*git2go.Cred, error) {
+		credCallback = func(url string, usernameFromURL string, allowedTypes git2go.CredType) (*git2go.Cred, error) {
 			cred, err := git2go.NewCredUserpassPlaintext(username, password)
 			if err != nil {
 				return nil, err
@@ -97,11 +99,12 @@ func (s *BasicAuth) Method(secret corev1.Secret) (*git.Auth, error) {
 
 type PublicKeyAuth struct {
 	user string
+	host string
 }
 
 func (s *PublicKeyAuth) Method(secret corev1.Secret) (*git.Auth, error) {
 	if _, ok := secret.Data[git.CAFile]; ok {
-		return nil, fmt.Errorf("found caFile key in secret '%s' but libgit2 SSH transport does not support custom certificates", secret.Name)
+		return nil, fmt.Errorf("found %s key in secret '%s' but libgit2 SSH transport does not support custom certificates", git.CAFile, secret.Name)
 	}
 	identity := secret.Data["identity"]
 	knownHosts := secret.Data["known_hosts"]
@@ -126,20 +129,24 @@ func (s *PublicKeyAuth) Method(secret corev1.Secret) (*git.Auth, error) {
 		user = git.DefaultPublicKeyAuthUser
 	}
 
-	credCallback := func(url string, username_from_url string, allowed_types git2go.CredType) (*git2go.Cred, error) {
+	credCallback := func(url string, usernameFromURL string, allowedTypes git2go.CredType) (*git2go.Cred, error) {
 		cred, err := git2go.NewCredSshKeyFromMemory(user, "", string(identity), "")
 		if err != nil {
 			return nil, err
 		}
 		return cred, nil
 	}
 	certCallback := func(cert *git2go.Certificate, valid bool, hostname string) git2go.ErrorCode {
+		host, _, err := net.SplitHostPort(s.host)
+		if err != nil || host != hostname {
+			return git2go.ErrUser
+		}
 		for _, k := range kk {
-			if k.matches(hostname, cert.Hostkey.HashSHA1[:]) {
+			if k.matches(s.host, cert.Hostkey.HashSHA1[:]) {
 				return git2go.ErrOk
 			}
 		}
-		return git2go.ErrGeneric
+		return git2go.ErrCertificate
 	}
 
 	return &git.Auth{CredCallback: credCallback, CertCallback: certCallback}, nil
@@ -151,7 +158,7 @@ type knownKey struct {
 }
 
 func parseKnownHosts(s string) ([]knownKey, error) {
-	knownHosts := []knownKey{}
+	var knownHosts []knownKey
 	scanner := bufio.NewScanner(strings.NewReader(s))
 	for scanner.Scan() {
 		_, hosts, pubKey, _, _, err := ssh.ParseKnownHosts(scanner.Bytes())
@@ -174,11 +181,12 @@ func parseKnownHosts(s string) ([]knownKey, error) {
 }
 
 func (k knownKey) matches(host string, key []byte) bool {
+	host = knownhosts.Normalize(host)
 	if !containsHost(k.hosts, host) {
 		return false
 	}
 
-	hash := sha1.Sum([]byte(k.key.Marshal()))
+	hash := sha1.Sum(k.key.Marshal())
 	if bytes.Compare(hash[:], key) != 0 {
 		return false
 	}

diff --git a/pkg/git/libgit2/transport_test.go b/pkg/git/libgit2/transport_test.go
@@ -73,8 +73,8 @@ func TestAuthSecretStrategyForURL(t *testing.T) {
 	}{
 		{"HTTP", "http://git.example.com/org/repo.git", &BasicAuth{}, false},
 		{"HTTPS", "https://git.example.com/org/repo.git", &BasicAuth{}, false},
-		{"SSH", "ssh://git.example.com:2222/org/repo.git", &PublicKeyAuth{}, false},
-		{"SSH with username", "ssh://[email protected]:2222/org/repo.git", &PublicKeyAuth{user: "example"}, false},
+		{"SSH", "ssh://git.example.com:2222/org/repo.git", &PublicKeyAuth{host: "git.example.com:2222"}, false},
+		{"SSH with username", "ssh://[email protected]:2222/org/repo.git", &PublicKeyAuth{user: "example", host: "git.example.com:2222"}, false},
 		{"unsupported", "protocol://example.com", nil, true},
 	}
 	for _, tt := range tests {